9kmy Privacy Policy – How We Handle Your Personal Data

1Introduction

9kmy ("we", "us", "our") operates the online gaming and sportsbook platform accessible at https://9kmy.app (the "Platform"). In the course of providing our services to players across Malaysia — including those in Kuala Lumpur, Penang, Johor Bahru, Petaling Jaya, and throughout the country — we necessarily collect and process certain personal information about you.

This Privacy Policy describes the types of personal data collected by 9kmy, the purposes for which it is processed, the parties with whom it may be shared, and the measures taken to protect it. It also details the rights available to you as a data subject under applicable data protection principles.

This Policy should be read in conjunction with the 9kmy Terms & Conditions and Responsible Gaming Policy. By registering an Account with 9kmy or otherwise accessing the Platform, you acknowledge that you have read and understood this Privacy Policy.

2Personal Data We Collect

9kmy collects only the personal data that is reasonably necessary for the purposes described in this Policy. The categories of personal data we collect include:

2.1 Identity Data

• Full legal name as it appears on your government-issued identification;
• Date of birth and age verification information;
• Malaysian MyKad number, passport number, or equivalent government-issued identification number;
• Copies of identity documents submitted for KYC verification purposes.

2.2 Contact Data

• Email address registered to your 9kmy Account;
• Malaysian mobile phone number;
• Residential address, including postcode and state (e.g., Selangor, Penang, Johor).

2.3 Financial Data

• Payment method details (e-wallet identifiers for Touch n Go, Boost, GrabPay; bank account details for Maybank, CIMB, Public Bank);
• Deposit and withdrawal transaction records in Malaysian Ringgit (MYR);
• Source of funds documentation submitted in connection with AML compliance.

2.4 Usage and Gaming Data

• Game play history, including game types, stakes, session durations, and outcomes;
• Sportsbook betting history, including markets, selections, and settlement results;
• Bonus and promotional redemption records;
• Account login timestamps, IP addresses, and device fingerprint data.

2.5 Technical Data

• IP address and approximate geographic location at the time of login;
• Browser type, operating system, and device model;
• Session duration and navigation patterns within the Platform;
• Cookie identifiers and analytics data (see Section 8).

3How We Collect Your Data

9kmy collects personal data through the following means:

• Direct submission: Information you provide when registering an Account, completing KYC, making deposits or withdrawals, contacting support, or participating in promotions;
• Automated collection: Technical and usage data collected automatically through cookies, server logs, and analytics tools when you access the Platform;
• Third-party sources: Identity verification data received from KYC and AML service providers; fraud signals received from payment processors and banking partners; publicly available information used for due diligence purposes.

4Purposes and Legal Basis for Processing

9kmy processes personal data only where there is a lawful basis to do so. The following table summarises the primary processing activities, their purposes, and the applicable legal basis:

5Data Sharing and Disclosure

9kmy does not sell, rent, or trade your personal data to third parties for commercial or marketing purposes. Data may be shared with the following categories of third parties, strictly on a need-to-know basis and subject to binding confidentiality obligations:

• KYC and identity verification providers: Third-party services that assist with verifying player identities and documents in compliance with our gaming licence requirements;
• Payment processors and banking partners: Including providers supporting Touch n Go eWallet, Boost, GrabPay, Maybank, CIMB, and Public Bank integrations, for the purpose of processing transactions;
• Fraud prevention and AML services: Specialist providers that assist in identifying and preventing financial crime on the Platform;
• Game content providers: Certified game studios whose titles are hosted on the 9kmy Platform may receive anonymised session data for technical and fairness auditing purposes;
• Regulatory and licensing authorities: 9kmy may be required to disclose player data to its licensing authority, financial intelligence units, or law enforcement agencies in response to lawful requests or as required under our gaming licence obligations;
• IT infrastructure providers: Cloud hosting and security providers involved in the operation of 9kmy's technical infrastructure, subject to data processing agreements.

6International Data Transfers

Some of 9kmy's third-party service providers and infrastructure partners may be located outside Malaysia. Where personal data is transferred internationally, 9kmy ensures that adequate safeguards are in place, consistent with the requirements of our gaming licence and applicable data protection standards. These safeguards may include contractual data processing agreements, standard contractual clauses, or transfers to jurisdictions with recognised adequacy determinations.

Players in Malaysia whose data is transferred internationally can be assured that the level of protection afforded to their data will be materially equivalent to that provided under this Privacy Policy, regardless of the country in which it is processed.

7Data Retention

9kmy retains personal data for the minimum period necessary to fulfil the purposes described in this Policy, taking into account applicable legal, regulatory, and contractual retention requirements. The general retention periods applicable at 9kmy are as follows:

• Account and KYC records: Retained for 7 years from the date of Account closure, as required under AML regulations applicable to gaming operators;
• Transaction records: Retained for 7 years from the date of each transaction for audit and regulatory purposes;
• Gameplay and betting history: Retained for 5 years from the date of each session or wager;
• Customer support records: Retained for 3 years from the date of the last interaction, or 7 years where the interaction relates to a dispute, fraud investigation, or regulatory matter;
• Marketing preference data: Retained until you withdraw consent or close your Account.

Upon expiry of the applicable retention period, personal data is securely deleted or anonymised in accordance with 9kmy's data destruction procedures.

8Cookies and Tracking Technologies

9kmy uses cookies and similar tracking technologies on the Platform for the following purposes:

• Essential cookies: Required for the Platform to function correctly, including session authentication, security tokens, and load balancing. These cannot be disabled without impairing Platform functionality;
• Analytics cookies: Used to collect aggregated, anonymised data about how players interact with the Platform, enabling 9kmy to identify and improve underperforming areas;
• Preference cookies: Store your language preferences, game lobby display settings, and other personalisation options;
• Security cookies: Assist in detecting fraudulent activity, multiple account indicators, and automated access attempts.

9kmy does not use third-party advertising cookies or permit ad networks to track your behaviour across external websites. You may adjust your browser settings to block or delete cookies, but doing so may impair certain features of the 9kmy Platform.

9Your Data Rights

Subject to applicable law and our legal retention obligations, you have the following rights in relation to the personal data 9kmy holds about you:

• Right of Access: You may request a copy of the personal data 9kmy holds about you, together with information about how it is used;
• Right to Rectification: You may request correction of inaccurate or incomplete personal data held in your Account;
• Right to Erasure: In certain circumstances, you may request the deletion of your personal data. This right is subject to overriding legal retention obligations applicable to gaming operators;
• Right to Restrict Processing: You may request that 9kmy restrict the processing of your data in certain circumstances, such as where accuracy is contested;
• Right to Data Portability: You may request a machine-readable copy of the personal data you provided to 9kmy, where technically feasible;
• Right to Object: You may object to processing based on legitimate interests, including the use of your data for analytics purposes;
• Right to Withdraw Consent: Where processing is based on your consent (e.g., marketing emails), you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, contact 9kmy's support team via live chat or email at [email protected]. 9kmy will respond to all verified data subject requests within 30 days.

10Children and Minors

The 9kmy Platform is strictly intended for adults aged 21 years and above. 21+ 9kmy does not knowingly collect personal data from individuals under the age of 21. Account registration requires confirmation of age eligibility, and KYC verification is used to validate age claims. Any Account found to belong to a minor will be immediately suspended, all funds forfeited, and the matter may be referred to appropriate authorities. If you have reason to believe that a minor has registered a 9kmy Account, please notify us immediately at [email protected].

11Security Measures

9kmy implements the following technical and organisational security measures to protect your personal data:

• 256-bit SSL/TLS encryption on all connections between your device and 9kmy's servers;
• Encryption at rest for all databases containing personal and financial data;
• Role-based access controls limiting staff access to personal data on a strict need-to-know basis;
• Multi-factor authentication required for all staff accessing production systems;
• Regular penetration testing and vulnerability assessments conducted by independent security firms;
• Incident response procedures governing the detection, containment, and notification of personal data breaches.

In the event of a personal data breach that poses a high risk to affected players, 9kmy will notify affected individuals without undue delay, in accordance with applicable breach notification requirements under our gaming licence.

12Marketing Communications

With your consent, 9kmy may send you promotional communications by email or SMS regarding new games, sportsbook promotions, reload bonuses, VIP programme updates, and platform news relevant to Malaysian players. You may withdraw consent and unsubscribe from marketing communications at any time by updating your preferences in your Account settings or by contacting 9kmy's support team.

Withdrawal of marketing consent does not affect your ability to use the 9kmy Platform or receive transactional communications (such as deposit confirmations, withdrawal notifications, and security alerts), which are sent on the basis of contract performance and cannot be opted out of while your Account remains active.

13Amendments to This Policy

9kmy reserves the right to update this Privacy Policy at any time to reflect changes in our data practices, legal obligations, or Platform functionality. Where amendments are material, 9kmy will notify registered players via email at least 14 days before the changes take effect. For minor amendments, notice will be provided by updating the "Last Updated" date at the top of this page. Continued use of the 9kmy Platform following the effective date of any amendment constitutes your acceptance of the revised Privacy Policy.

14Contact & Data Complaints

If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how 9kmy handles your personal information, please contact our Data Protection team:

• Live Chat: Available 24/7 from within the 9kmy Platform after logging in — the fastest way to raise urgent data queries;
• Email: [email protected] (plain text — not a clickable link).

9kmy aims to acknowledge all privacy-related enquiries within 48 hours and to resolve them within 30 days. If you are not satisfied with our response to your privacy complaint, you may escalate the matter to the data protection supervisory authority applicable under our gaming licence jurisdiction.